{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T03:18:32Z","timestamp":1782875912425,"version":"3.54.5"},"reference-count":23,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2023,2,16]],"date-time":"2023-02-16T00:00:00Z","timestamp":1676505600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JCP"],"abstract":"<jats:p>Knowledge of possible cyber threats as well as awareness of appropriate security measures plays a crucial role in the ability of individuals to not only discriminate between an innocuous versus a dangerous cyber event, but more importantly to initiate appropriate cybersecurity behaviors. The purpose of this study was to construct a Cybersecurity Awareness INventory (CAIN) to be used as an instrument to assess users\u2019 cybersecurity knowledge by providing a proficiency score that could be correlated with cyber security behaviors. A scale consisting of 46 items was derived from ISO\/IEC 27032. The questionnaire was administered to a sample of college students (N = 277). Based on cybersecurity behaviors reported to the research team by the college\u2019s IT department, each participant was divided into three groups according to the risk reports they received in the past nine months (no risk, low risk, and medium risk). The ANOVA results showed a statistically significant difference in CAIN scores between those in the no risk and medium-risk groups; as expected, CAIN scores were lower in the medium-risk group. The CAIN has the potential to be a useful assessment tool for cyber training programs as well as future studies investigating individuals\u2019 vulnerability to cyberthreats.<\/jats:p>","DOI":"10.3390\/jcp3010005","type":"journal-article","created":{"date-parts":[[2023,2,16]],"date-time":"2023-02-16T05:27:38Z","timestamp":1676525258000},"page":"61-75","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["The Cybersecurity Awareness INventory (CAIN): Early Phases of Development of a Tool for Assessing Cybersecurity Knowledge Based on the ISO\/IEC 27032"],"prefix":"10.3390","volume":"3","author":[{"given":"Giorgia","family":"Tempestini","sequence":"first","affiliation":[{"name":"Department of Planning, Design, and Technology of Architecture, Sapienza University of Rome, 00196 Rome, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ericka","family":"Rovira","sequence":"additional","affiliation":[{"name":"Department of Behavioral Sciences and Leadership, U.S. Military Academy, West Point, NY 10996, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aryn","family":"Pyke","sequence":"additional","affiliation":[{"name":"Department of Behavioral Sciences and Leadership, U.S. Military Academy, West Point, NY 10996, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3000-2616","authenticated-orcid":false,"given":"Francesco","family":"Di Nocera","sequence":"additional","affiliation":[{"name":"Department of Planning, Design, and Technology of Architecture, Sapienza University of Rome, 00196 Rome, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,2,16]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"102248","DOI":"10.1016\/j.cose.2021.102248","article-title":"Cyber security in the age of COVID-19: A timeline and analysis of cyber-crime and cyber-attacks during the pandemic","volume":"105","author":"Lallie","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_2","unstructured":"World Economic Forum (2022, July 01). COVID-19 Risks Outlook: A Preliminary Mapping and its Implications. Available online: https:\/\/www.weforum.org\/reports\/covid-19-risks-outlook-a-preliminary-mapping-and-itsimplications."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"3030","DOI":"10.3389\/fpsyg.2020.546546","article-title":"Taking risks with cybersecurity: Using knowledge and personal characteristics to predict self-reported cybersecurity behaviors","volume":"11","author":"Kennison","year":"2020","journal-title":"Front. Psychol."},{"key":"ref_4","unstructured":"(2022, July 01). IBM Security Services 2014 Cyber Security Intelligence Index. Available online: https:\/\/media.scmagazine.com\/documents\/82\/ibm_cyber_security_intelligenc_20450.pdf."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"95","DOI":"10.26735\/WLPW6121","article-title":"Overview of the Impact of Human Error on Cybersecurity based on ISO\/IEC 27001 Information Security Management","volume":"4","year":"2021","journal-title":"J. Inf. Secur. Cybercrimes Res."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Lorenz, B., Kikkas, K., and Klooster, A. (2013, January 21\u201326). \u201cThe four most-used passwords are love, sex, secret, and god\u201d: Password security and training in different user groups. Proceedings of the International Conference on Human Aspects of Information Security, Privacy, and Trust, Las Vegas, NV, USA.","DOI":"10.1007\/978-3-642-39345-7_29"},{"key":"ref_7","unstructured":"(2012). Information Technology e Security Techniques e Guidelines for Cybersecurity (Standard No. ISO\/IEC 27032:2012)."},{"key":"ref_8","first-page":"026666692199751","article-title":"Development of the cybersecurity scale (CS-S): Evidence of validity and reliability","volume":"38","author":"Arpaci","year":"2021","journal-title":"Inf. Dev."},{"key":"ref_9","first-page":"133","article-title":"Students\u2019 cybersecurity awareness at a private tertiary educational institution","volume":"20","author":"Chandarman","year":"2017","journal-title":"Afr. J. Inf. Commun."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"tyac006","DOI":"10.1093\/cybsec\/tyac006","article-title":"Developing metrics to assess the effectiveness of cybersecurity awareness program","volume":"8","author":"Chaudhary","year":"2022","journal-title":"J. Cybersecur."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"92","DOI":"10.1016\/j.compedu.2008.06.011","article-title":"The impact of information richness on information security awareness training effectiveness","volume":"52","author":"Shaw","year":"2009","journal-title":"Comput. Educ."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"51","DOI":"10.1016\/j.chb.2015.01.039","article-title":"Effects of cyber security knowledge on attack detection","volume":"48","author":"Gonzalez","year":"2015","journal-title":"Comput. Hum. Behav."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1038","DOI":"10.1016\/j.tele.2017.04.013","article-title":"The privacy paradox\u2013Investigating discrepancies between expressed privacy concerns and actual online behavior\u2013A systematic literature review","volume":"34","author":"Barth","year":"2017","journal-title":"Telemat. Inform."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"410","DOI":"10.1016\/j.cose.2007.03.001","article-title":"Assessing the security perceptions of personal Internet users","volume":"26","author":"Furnell","year":"2007","journal-title":"Comput. Secur."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"870","DOI":"10.1016\/j.ijhcs.2011.07.007","article-title":"Factors affecting perception of information security and their impacts on IT adoption and security practices","volume":"69","author":"Huang","year":"2011","journal-title":"Int. J. Hum.-Comput. Stud."},{"key":"ref_16","unstructured":"Bravo-Lillo, C., Cranor, L., Komanduri, S., Schechter, S., and Sleeper, M. (2014, January 9\u201311). Harder to Ignore? Revisiting {Pop-Up} Fatigue and Approaches to Prevent It. Proceedings of the 10th Symposium On Usable Privacy and Security (SOUPS 2014), Menlo Park, CA, USA."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Bravo-Lillo, C., Komanduri, S., Cranor, L.F., Reeder, R.W., Sleeper, M., Downs, J., and Schechter, S. (2013, January 24\u201326). Your attention please: Designing security-decision UIs to make genuine risks harder to ignore. Proceedings of the Ninth Symposium on Usable Privacy and Security, Newcastle, UK.","DOI":"10.1145\/2501604.2501610"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Li, L., He, W., Xu, L., Ivan, A., Anwar, M., and Yuan, X. (2014, January 2\u20133). Does explicit information security policy affect employees\u2019 cyber security behavior? A pilot study. Proceedings of the 2014 Enterprise Systems Conference, Shanghai, China.","DOI":"10.1109\/ES.2014.66"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"165","DOI":"10.1016\/j.cose.2013.12.003","article-title":"Determining employee awareness using the human aspects of information security questionnaire (HAIS-Q)","volume":"42","author":"Parsons","year":"2014","journal-title":"Comput. Secur."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"274","DOI":"10.1016\/j.cose.2005.04.003","article-title":"Why users cannot use security","volume":"24","author":"Furnell","year":"2005","journal-title":"Comput. Secur."},{"key":"ref_21","unstructured":"R Core Team (2022). R: A Language and Environment for STATISTICAL Computing, R Foundation for Statistical Computing. Available online: https:\/\/www.R-project.org\/."},{"key":"ref_22","first-page":"1","article-title":"ltm: An R package for latent variable modeling and item response analysis","volume":"17","author":"Rizopoulos","year":"2022","journal-title":"J. Stat. Softw."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Razaque, A., Al Ajlan, A., Melaoune, N., Alotaibi, M., Alotaibi, B., Dias, I., Oad, A., Hariri, S., and Zhao, C. (2021). Avoidance of Cybersecurity Threats with the Deployment of a Web-Based Blockchain-Enabled Cybersecurity Awareness System. Appl. Sci., 11.","DOI":"10.20944\/preprints202107.0120.v1"}],"container-title":["Journal of Cybersecurity and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2624-800X\/3\/1\/5\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T18:38:17Z","timestamp":1760121497000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2624-800X\/3\/1\/5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,2,16]]},"references-count":23,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,3]]}},"alternative-id":["jcp3010005"],"URL":"https:\/\/doi.org\/10.3390\/jcp3010005","relation":{},"ISSN":["2624-800X"],"issn-type":[{"value":"2624-800X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,2,16]]}}}